I’m an avid user of the cloud document creation platform Google Documents (or affectionately G-docs), which has since been rolled into the aforementioned Google Drive. I have never installed Microsoft Office on my Mac, so it’s my default productivity suite. I use it to create personal finance spreadsheets, to take notes during phone interviews, and to draft all the articles I would eventually publish on PandoDaily. It even serves as a real time collaboration platform with my editors and colleagues. My PandoDaily Google Drive account has seen more than 1,200 items created in the last 9 months, let alone the several thousand I’ve created in my personal equivalent dating back to sometime in 2007, shortly following its launch.

And yet yesterday was the first time I ever felt that the platform presented a security risk.

Before I get into the details, let’s establish why this is important. Beyond any personal information I may share in these documents, I often input the confidential details of the companies I report on: product launches, executive hires, fundings, and closures. In our industry, trust is the primary currency on which we trade. Should that trust be compromised, whether through fault of my own or through that of some technology on which I rely, it would be tough to rebuild.

And I’m far from the only user who relies on the Google Apps platform for mission critical tasks and high value information. According to the company, “Over 5 million businesses have gone Google.”

So here’s what happened. In the process of writing this story yesterday, I composed a draft in Google Drive. The last time I opened that draft was 3:37pm, and then transitioned at that point to WordPress. The story was then published on PandoDaily at 5:14 pm. At 5:25 pm, I got the first email from Google, informing me that an absolute stranger had requested access to this Google Document. In the roughly 18 hours since, I have received eight more such requests, making nine in total.

This is the first time I have ever encountered this issue.

The sharing settings on the document are set to “Private – Only the people listed below can access.” The only name listed below is mine, next to which is the designation “Owner.” So how did these nine strangers know this document existed? And how did they know the name and, or the unique URL to which to request access? A Google search for the domain corresponding to the document – which presumably only I know – turns up no results. Viewing my Google+ profile as “Public” similarly offers no clues.

One commenter in a Google Drive product forum speculated as to a possible explanation. Trunky, a “level 1” contributor to the forum, conjectured that owners of the websites underlying the hyperlinks in a Google Document might get notified of those links and then, in turn, request access. Other commenters in similar threads offer the same explanation. On the surface this would seem plausible, and in some cases it may even be the correct explanation. In total, I linked out to four websites in the article in question, although only one non-PandoDaily piece of content – an ecommerce report from Nielsen Korea.

What doesn’t jive with the theory in my particular case is the names and profiles of the individuals requesting access. One was a Melbourne-based software consultant, according to his Google+ profile. Another is an “ecommerce expert” based in Long Beach. The others either turn up no results in a Google Search of their Gmail address, or return complaints of “endless spamming.” None of them, however, suggest ownership of the Nielsen Korea page.

At this point, I’m at a loss for explaining the occurrence. I have reached out to Google for comment but have yet to receive a response. Until I can get a concrete explanation, I won’t use Google Drive to create or manage documents containing sensitive information.

Update I: Following the publishing of this post, we received the following response from a Google Drive spokesperson:

That is very weird – I totally agree. Unfortunately, I don’t have any additional insight. You already checked the hyperlinks and any other possible connections between WordPress and the Google Doc, which would have been my first guess. If it’s not that, I’m not sure from your description what else it could have been.

Now that you’re aware of the issue, I’d suggest just writing your articles like normal but keeping an eye on the requests. Let me know if this happens again, with as much detail as you can provide about your copy-and-paste process.

Update II: A commenter below identified himself as the “Melbourne-based software consultant” referenced in the post and indicated that he clicked on the link to the Nielsen survey and was directed to a Google Drive page where he was asked to request access to the document in question. One possible explanation for this would be that the URL for the Google Drive document was incorrectly inserted into the survey huperlink, however there were no changes on our end between yesterday and today, to my knowledge, yet this does not seem to be the case currently. We will continue to explore any possible explanation on our end.

Michael Carney is a West Coast Editor at PandoDaily, covering venture capital, financial technologies, ecommerce, on-demand services, and the future of television, among other subjects. He has spent his career exploring the world of early stage technology as an entrepreneur and early-stage investor, working in multiple countries within North and South America and Asia. He is an enthusiast of all things shiny and electronic and is inspired by those who build businesses and regularly tackle difficult problems. You can follow Michael on Twitter @mcarney.

Booker, which helps service businesses better engage with customers online, has raised $35 million in a Series C round led by Medina Capital, with participation from strategic investor First Data, Jump Capital, and Signal Peak Ventures, as well as existing investors. The New York City company now sees 3 million appointments booked monthly across 73 countries in 11 languages on its platform. [via Booker]

PCH, a company which “helps entrepreneurs turn ideas into brands and makes a variety of consumer tech products for major companies such as Apple,” has acquired Fab for a reported $15 million in cash and stock. Fab previously had a $1 billion valuation and raised $325 million. It will “continue to focus on design” at PCH. [Source: Bloomberg]

BlackBerry has unveiled several new smartphones at the Mobile World Congress in Barcelona, including the touchscreen-focused BlackBerry Leap and a device with a “dual curve slider,” in addition to its keyboard-equipped products. [Source: New York Times]

March 3, 2015

“I hope to have a bigger presence in the tech world. I love coming up with different app ideas, and I have a few more that are coming out. Once you get started and you have this creative bug of ideas that you want to get out, I feel like I’ve partnered with the right team, and now I have the creative outlet to make that happen. I’m happy that people are into it and perceiving it well. I just want to create more apps.”

PayPal is planning to acquire Paydiant, the company behind CurrentC — retailers’ answer to Apple Pay — for a reported $280 million. No word yet on how the companies will mix, nor if Paydiant’s relationship with the industry group behind CurrentC will remain intact. [Source: Re/code]

Microsoft is in talks to acquire Prismatic, a news aggregation service that uses natural language processing to recommend content in which its users might be interested, according to a report from TechCrunch. Apple, Yahoo, Google, and Facebook are all said to have expressed similar interest in the company. (Which is surely a sign of actual interest and not at all an attempt by someone at the company to make it seem like a hot commodity — right?) [Source: TechCrunch]

March 2, 2015

“Just wanted to confirm that the rumors are true — I’m excited to be running Google’s Photos and Streams products! It’s important to me that these changes are properly understood to be positive improvements to both our products and how they reach users.”

Samsung has announced Samsung Pay, a competitor to the Apple Pay product included in Apple’s latest iPhones, at the Mobile World Congress in Barcelona. The feature will allow new Samsung Galaxy S6 owners who use MasterCard to pay for goods with their phones. It’s not clear when other credit card companies will be supported. [Source: The Guardian]